"""Pure, offline tests for target_revenue.breach_record._validate
(WP-0006-T09). No Docker/Postgres required — persistence/publication
round-trips are covered by the Docker-gated tests in
tests/test_ledger_hosting.py.
"""

from __future__ import annotations

from target_revenue import breach_record


def _base_event(**overrides):
    event = {
        "id": "trsl:breach:example0010001",
        "case_id": "trsl:case:example001",
        "event_type": "alleged",
        "category": "unauthorized-commercial-use",
        "event_at": "2026-08-01T00:00:00Z",
    }
    event.update(overrides)
    return event


def test_valid_anonymized_alleged_event_has_no_errors():
    assert breach_record._validate(_base_event()) == []


def test_missing_required_field_rejected():
    event = _base_event()
    del event["category"]
    errors = breach_record._validate(event)
    assert any("category" in e for e in errors)


def test_unknown_event_type_rejected():
    errors = breach_record._validate(_base_event(event_type="dismissed"))
    assert any("event_type" in e for e in errors)


def test_named_disclosure_requires_holder_and_authorization():
    errors = breach_record._validate(_base_event(anonymized=False))
    assert any("named_entitlement_holder" in e for e in errors)
    assert any("named_disclosure_authorized_under_cua" in e for e in errors)


def test_named_disclosure_with_holder_but_no_authorization_still_rejected():
    errors = breach_record._validate(
        _base_event(anonymized=False, named_entitlement_holder="Acme Corp")
    )
    assert any("named_disclosure_authorized_under_cua" in e for e in errors)


def test_named_disclosure_with_holder_and_authorization_accepted():
    errors = breach_record._validate(
        _base_event(
            anonymized=False,
            named_entitlement_holder="Acme Corp",
            named_disclosure_authorized_under_cua=True,
        )
    )
    assert errors == []


def test_anonymized_event_with_holder_set_rejected():
    """A caller must not be able to sneak a name in while anonymized=True."""
    errors = breach_record._validate(
        _base_event(anonymized=True, named_entitlement_holder="Acme Corp")
    )
    assert any("must not be set" in e for e in errors)